Third-Party Risk Management
What is Third-Party Risk Management?
The process of identifying, assessing, and managing risks associated with outsourcing to or partnering with external organisations. Includes vendor due diligence and ongoing monitoring.
Related terms
Frameworks that govern third-party risk management
What the standards actually require on third-party risk management
Requirements naming third-party risk management across 6 standards, quoted from the control text.
Staff the central third-party function with appropriately skilled people; consider critical operations' dependence on third parties, concentration risk, geopolitical risk and fourth parties (subcontractors);
japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.6-D · 2.6 Third-party risk management: desirable actions →Operate third-party risk management per OSFI B-13 Domain 4 + complementary OSFI Guideline B-10 Outsourcing of Business Activities and Functions.
OSFIB13-4 · Third-Party Risk Management and Cloud →Information security requirements for suppliers and service providers. Assessment of third-party security posture. Contractual security requirements. Supply chain risk management for automotive data.
TISAX-IS-03 · Third-Party Risk Management →Requirement 0041 (Part Two: Risk, section 6.1 Third Party Risk Management; applies to All entities; dated 31 October 2024; retained from Release 2025): Entity ensures service providers, contractors and subcontractors comply with relevant PSPF Requirements as d...
protective-security-policy-framework-pspf-release-2026::0041 · 0041 Ensure providers and subcontractors comply with relevant PSPF requirements →Supply chain personnel, drawn from development, procurement, logistics, maintenance, project management, IT, contracting, finance, information security and third-party risk management with internal roles such as the chief risk officer, CIO, CISO, program execu...
ffiec-it-examination-handbook::DAM-II.B.7 · II.B.7 Supply Chain Roles (Development, Acquisition, and Maintenance) →The ESAs, through the Joint Committee, designate which ICT third-party service providers are critical, according to systemic impact, the importance of the institutions relying on them, reliance for critical or important functions and substitutability, and publ...
DORA-Art.31 · Designation of critical ICT third-party service providers →Questions people ask about third-party risk management
What is Third-Party Risk Management?
Why is Third-Party Risk Management important for compliance?
What concepts are related to Third-Party Risk Management?
Which compliance frameworks address Third-Party Risk Management?
Where can I learn more about Third-Party Risk Management?
See how Third-Party Risk Management applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.